<meta http-equiv="Content-Security-Policy" content="default-src 'self' ajax.googleapis.com">